Sign up for our daily briefing
Make your busy days simpler with Axios AM/PM. Catch up on what's new and why it matters in just 5 minutes.
Catch up on coronavirus stories and special reports, curated by Mike Allen everyday
Catch up on coronavirus stories and special reports, curated by Mike Allen everyday
Denver news in your inbox
Catch up on the most important stories affecting your hometown with Axios Denver
Des Moines news in your inbox
Catch up on the most important stories affecting your hometown with Axios Des Moines
Minneapolis-St. Paul news in your inbox
Catch up on the most important stories affecting your hometown with Axios Twin Cities
Tampa Bay news in your inbox
Catch up on the most important stories affecting your hometown with Axios Tampa Bay
Charlotte news in your inbox
Catch up on the most important stories affecting your hometown with Axios Charlotte
Illustration: Aïda Amer/Axios
Victims of ransomware attacks who pay criminals to release their data may be held liable for violating U.S. sanctions — even if they don’t know the true identity of their tormentors, advised the Treasury Department in a bulletin last week.
Why it matters: The move could doubly punish the victims of ransomware attacks.
Between the lines: The cyber criminals responsible for major ransomware attacks do not often volunteer their true identities to their victims, and the payment schemes are generally conducted anonymously using cryptocurrency.
- It’s not just victims who might be subject to civil penalties for paying sanctioned ransomware attackers, says the Treasury, but also “those involved in providing cyber insurance, digital forensics and incident response, and financial services that may involve processing ransom payments.”
Background: The Treasury, through its Office of Foreign Assets Control, sanctions entities and individuals deemed national security threats — including state-linked hackers, terrorists and even transnational cyber criminal groups. Under these sanctions, U.S. persons or businesses are totally forbidden from facilitating or carrying out any financial exchange with these entities.
- Some of these sanctioned groups, like the Russian cyber criminal syndicate Evil Corp, act generally on their own behalf and are motivated by private profit.
- But other sanctioned entities, like the Lazarus Group, which is directly connected with North Korean intelligence, use ransomware attacks to pad the coffers of foreign governments.
By the numbers: Reports of ransomware attacks increased 37% from 2018 to 2019, according to the FBI, with a 147% spike in “associated losses” during that period, per the Treasury bulletin.
Go deeper: 🎧 Axios Re:Cap podcast: American health care held for ransom (listen here)